Shaping  Operations  to  Attack  Robust  Terror  Networks 


Devon  Callahan,  Paulo  Shakarian 
Network  Science  Center  and 
Dept,  of  Electrical  Engineering 
and  Computer  Science 
United  States  Military  Academy 
West  Point,  NY  10996 
Email:  devon.callahan@usma.edu, 
paulo@shakarian.net 


Jeffrey  Nielsen,  Anthony  N.  Johnson 
Network  Science  Center  and 
Dept,  of  Mathematical  Science 
United  States  Military  Academy 
West  Point,  NY  10996 
Email:  j effrey. nielsen@usma.edu , 
anthony.johnson@usma.edu 


ABSTRACT 

Security  organizations  often  attempt  to  disrupt  ter¬ 
ror  or  insurgent  networks  by  targeting  “high  value 
targets”  (HVT’s).  However,  there  have  been  numer¬ 
ous  examples  that  illustrate  how  such  networks  are 
able  to  quickly  re-generate  leadership  after  such  an 
operation.  Here,  we  introduce  the  notion  of  a  shap¬ 
ing  operation  in  which  the  terrorist  network  is  first 
targeted  for  the  purpose  of  reducing  its  leadership 
re-generation  ability  before  targeting  HVT’s.  We 
look  to  conduct  shaping  by  maximizing  the  network¬ 
wide  degree  centrality  through  node  removal.  We 
formally  define  this  problem  and  prove  solving  it  is 
NP-Complete.  We  introduce  a  mixed  integer-linear 
program  that  solves  this  problem  exactly  as  well  as 
a  greedy  heuristic  for  more  practical  use.  We  imple¬ 
ment  the  greedy  heuristic  and  found  in  examining  five 
real-world  terrorist  networks  that  removing  only  12% 
of  nodes  can  increase  the  network-wide  centrality  be¬ 
tween  17%  and  45%.  We  also  show  our  algorithm 
can  scale  to  large  social  networks  of  1, 133  nodes  and 
5,  541  edges  on  commodity  hardware. 

I  INTRODUCTION 

Terrorist  and  insurgent  networks  are  known  for  their 
ability  to  regenerate  leadership  after  targeted  attacks. 
For  example,  the  infamous  A1  Qaeda  in  Iraq  terror¬ 
ist  leader  Abu  Musab  al-Zarqawi  was  killed  on  June 
8th,  2006  1  only  to  be  replaced  with  Abu  Ayyub  al- 
Masri  about  a  week  later.  2  Here,  we  introduce  the 
notion  of  a  shaping  operation  in  which  the  terrorist 
network  is  first  targeted  for  the  purpose  of  reduc¬ 
ing  its  leadership  re-generation  ability.  Such  shap¬ 
ing  operations  would  then  be  followed  by  normal  at¬ 
tacks  against  high  value  targets  -  however  the  net¬ 
work  would  be  less  likely  to  recover  due  to  the  initial 
shaping  operations.  In  this  paper,  we  look  to  shape 
such  networks  by  increasing  network-wide  centrality, 


first  introduced  in  [1].  Intuitively,  this  measure  pro¬ 
vides  insight  into  the  criticality  of  high-degree  nodes. 
Hence,  a  network  with  a  low  network-wide  central¬ 
ity  is  a  more  decentralized  organization  and  likely 
to  regenerate  leadership.  In  the  shaping  operations 
introduced  in  this  paper,  we  seek  to  target  nodes 
that  will  maximize  this  measure  -  making  follow-on 
attacks  against  leadership  more  effective.  Previous 
work  has  primarily  dealt  with  the  problem  of  lead¬ 
ership  regeneration  by  focusing  on  individuals  likely 
to  emerge  as  new  leaders  [2].  However,  targeting  or 
obtaining  information  about  certain  individuals  may 
not  always  be  possible.  Hence,  in  this  paper,  we  tar¬ 
get  nodes  that  affect  the  reduce  the  network ’s  ability 
regenerate  leadership  as  a  whole. 

The  main  contributions  of  this  paper  is  the  introduc¬ 
tion  of  a  formal  problem  we  call  FRAGILITY  (Sec¬ 
tion  II)  which  seeks  to  find  a  set  of  nodes  whose  re¬ 
moval  would  maximize  the  network-wide  centrality. 
We  also  included  in  the  problem  a  “no  strike  list”  - 
nodes  in  the  network  that  cannot  be  targeted  for  var¬ 
ious  reasons.  This  is  because  real-world  targeting  of 
terrorist  or  insurgent  networks  often  includes  restric¬ 
tions  against  certain  individuals.  We  also  prove  that 
this  problem  is  NP-complete  (and  the  associated  op¬ 
timization  problem  is  NP-hard)  which  means  that  an 
efficient  algorithm  to  solve  it  optimally  is  currently 
unknown.  We  then  provide  two  algorithms  for  solv¬ 
ing  this  problem  (Section  III).  Our  first  algorithm 
is  an  integer  program  that  ensures  an  exact  solu¬ 
tion  and,  though  intractable  by  our  complexity  re¬ 
sult,  may  be  amenable  to  an  integer  program  solver. 
Then  we  introduce  a  greedy  heuristic  that  we  show 
experimentally  (in  Section  IV)  to  provide  good  re¬ 
sults  in  practice  (as  we  demonstrate  on  six  different 
real-world  terrorist  networks)  and  scales  to  networks 
of  1,133  nodes  and  5,541  edges.  In  examining  five 
real-world  terrorist  networks,  we  found  that  success¬ 
ful  targetting  operations  against  only  12%  (or  less) 
of  nodes  can  increase  the  network-wide  centrality  be- 


1  http:  / / www.nytimes.com/2006/06/08/world/middleeast/08cnd-iraq.html7_i-l 

“http:/ /articles. cnn. com/2006-06-15/world/iraq.main_l_al-zarqawi-al-qaeda-leader-zawahiri?_s=PM:  WORLD 
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tween  17%  and  45%.  Additionally,  we  discuss  related 
work  further  in  Section  V. 

We  would  like  to  note  that  the  targeting  of  individuals 
in  a  terrorist  or  insurgent  network  does  not  necessar¬ 
ily  mean  to  that  they  should  be  killed.  In  fact,  for 
“shaping  operations”  as  the  ones  described  in  this  pa¬ 
per,  the  killing  of  certain  individuals  in  the  network 
may  be  counter-productive.  This  is  due  to  the  fact 
that  the  capture  of  individuals  who  are  likely  emer¬ 
gent  leaders  may  provide  further  intelligence  on  the 
organization  in  question. 

II  TECHNICAL  PRELIMINARIES  AND 
COMPUTATIONAL  COMPLEXITY 

We  assume  that  an  undirected  social  network  is  rep¬ 
resented  by  the  graph  G  =  (V,  E) .  Additionally,  we 
assume  a  “no  strike”  set,  S  C  V.  Intuitively,  these  are 
nodes  in  a  terrorist/insurgent  network  that  cannot  be 
targeted.  This  set  is  a  key  part  of  our  framework,  as 
real-world  targeting  of  terrorist  and/or  insurgents  in 
a  terrorist/insurgent  network  is  often  accompanied 
by  real-world  constraints.  For  example,  consider  the 
following: 


maximum  degree  of  the  network.  Given  some  subset 
V'  C  V,  we  will  use  the  notation  G(V')  to  denote 
the  subgraph  of  G  induced  by  V' .  We  describe  an 
example  network  in  Example  II.  1. 

Example  II.  1.  Consider  network  Gsam  in  [Figure 
1 /.  Nodes  a  and  b  may  be  leaders  of  a  strategic  cell 
that  provides  guidance  to  attack  cells  (nodes  c-f  and 
g-j).  Note  that  no  members  in  the  attack  cells  are 
linked  to  each  other.  Also  note  that  if  node  a  is  the 
leader,  and  targeted,  he  could  easily  be  replaced  by  b. 


•  We  may  know  an  individual’s  relationships  in 
the  terrorist /insurgent  network,  but  may  not 
have  enough  information  (i.e.  where  he  or  she 
may  reside,  enough  evidence,  etc.)  to  actually 
target  him  or  her. 


fig  1.  Sample  network  (Gsam)  for  Example  II.l. 

1  NETWORK-WIDE  DEGREE  CEN¬ 
TRALITY 


•  The  potential  target  may  be  politically  sensi¬ 
tive. 

•  The  potential  target  may  have  fled  the  coun¬ 
try  or  area  of  operations  but  still  maintains  his 
or  her  role  in  the  terrorist /insurgent  network 
through  electronic  communication. 

•  The  potential  “target”  may  actually  be  a 
source  of  intelligence  and/or  part  of  an  ongoing 
counter-intelligence  operation  (i.e.  as  described 
in  [3]). 


Throughout  this  paper  we  will  also  use  the  follow¬ 
ing  notation.  The  symbols  Nq,Mq  will  denote  the 
sizes  of  V,  E  respectively.  For  each  i  £  V ,  we  will  use 
di  to  denote  the  degree  of  that  node  (the  number  of 
individuals  he/she  is  connected  to)  and  rp  to  denote 
the  set  of  neighbors  and  we  extend  this  notation  for 
subsets  of  V  (for  V'  C  V,rj(V')  =  \JieV'  hi)-  We  will 
use  the  notation  m  to  denote  all  edges  in  E  that  are 
adjacent  to  node  i  and  the  notation  d*G  to  denote  the 


We  now  introduce  the  notion  of  network-wide  degree 
centrality  as  per  [1],  The  key  intuition  of  this  paper 
is  to  use  this  centrality  as  a  measure  of  the  network’s 
ability  to  re-generate  leadership. 


Definition  II.l  (Network-Wide  Degree  Central¬ 
ity  [1]).  The  degree  centrality  of  a  network  G,  denoted 
Cq  is  defined  as: 


CG 


dp  dj 

(Ng  -  1  ){Ng  -  2) 


(1) 


We  note  that  there  are  other  types  of  network-wide 
centrality  (i.e.  network-wide  betweenness,  closeness, 
etc.).  We  leave  the  consideration  of  these  alternate 
definitions  of  network-wide  centrality  to  future  work. 
Freeman  [1]  shows  that  for  a  star  network,  the  quan¬ 
tity  J2i  —  di  ecluals  (AIg  —  1  ){Ng  —  2)  -  and  this  is 
the  maximum  possible  value  for  this  quantity.  Hence, 
the  value  for  Cq  can  be  at  most  1.  As  this  equation 
is  clearly  always  positive,  network-wide  degree  cen¬ 
trality  is  a  scalar  in  [0,1].  Turning  back  to  Exam¬ 
ple  II.l,  we  can  compute  CGsarn  =  0.38  -  which  seems 
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to  indicate  that  in  this  particular  terrorist/insurgent 
network  that,  after  leadership  is  targeted,  there  is  a 
cadre  of  second-tier  individuals  who  can  eventually 
take  control  of  the  organization.  Throughout  this 
paper,  we  find  it  useful  to  manipulate  Equation  1  as 
follows. 


NGd*G  -  2 Mg 
(Ng  —  1)(Ng  —  2) 


(2) 


sions. 


FRAGILITY (k,  x,  G,  S ): 

INPUT:  Natural  number  k,  real  number  x,  network 
G  =  (V,E),  and  no-strike  set  S 
OUTPUT:  “Yes”  if  there  exists  set  V'  C  V  —  S  s.t. 
\V'\  <  k  and  fragileG(V' )  >  x  -  “no”  otherwise. 


We  notice  that  the  centrality  of  a  network  really 
depends  on  three  things:  number  of  nodes,  num¬ 
ber  of  edges,  and  the  highest  degree  of  any  node 
in  the  network.  We  leverage  this  re-arranged  equa¬ 
tion  in  many  of  our  proofs.  Further,  we  will  use  the 
function  fragileG  :  V  — »  3?  to  denote  the  level  of 
network-wide  of  the  graph  after  some  set  of  nodes 
is  removed.  Hence,  fragileG(V')  =  CG(y-V')-  We 
note  that  this  function  has  some  interesting  charac¬ 
teristics.  For  example,  for  some  subset  V'  C  V  and 
element  i  G  V —  V' ,  it  is  possible  that  fragileG(Vf)  > 
fragile(V'U{i})  or  fragileG(V')  <  fragile(V'U{i}), 
hence  fragileG  is  not  necessarily  monotonic  or  anti¬ 
monotonic  in  this  sense.  Further,  given  some  ad¬ 
ditional  element  j  G  V  —  V',  it  is  possible  that 
fragileG{V'  U  {.)})  -  fragileG{V')  >  fragileG(V'  U 
{*.  j})  -  fragileG(V'  U  {j})  or  fragileG{V'  U  {j})  - 
fragileG(V')  <  fragileG(V'U{i,j})- fragileG(V'U 
{j}).  Hence,  fragileG  is  not  necessarily  sub-  or 
super-  modular  either.  Consider  Example  II. 2. 

Example  II. 2.  Consider  the  network  Gsam  in 
[Figure  1].  Here,  fragileGsam(ty)  =  0.33, 

fragileGsam({a})  =  fragileGsam({b})  =  0.57, 

fragileGsam({c})  =  0.30,  and  fragileGsam({a,b})  = 
0.0.  The  fact  that  fragileGsarn  ({c}  <  fragileGsam{fH) 
and  fragileGsam({a}  >  fragileGsam(®)  illustrate 
that  fragileGsam  is  not  necessarily  monotonic  or 
anti-monotonic.  Now  let  us  consider  the  incremen¬ 
tal  increase  of  adding  an  additional  element.  Adding 
a  to  0  causes  fragileGsam  to  increase  by  0.24  while 
adding  a  to  {5}  D  0  causes  fragileGsarrl  to  decrease 
by  0.57  -  implying  sub-modularity.  However,  adding 
c  to  0  causes  fragileGsam  to  decrease  by  0.03  while 
adding  c  to  set  {a,  b}  D  0  causes  fragileGsam  to  in¬ 
crease  by  0.1  (as  fragileGsam({a,b,c}  =  0.1,)  -  im¬ 
plying  super-modularity.  Hence,  fragileGsam  is  not 
necessarily  sub-  or  super-  modular. 

2  PROBLEMS  AND  COMPLEXITY  RE¬ 
SULTS 

We  now  have  all  the  pieces  to  introduce  our  problems 
of  interest.  We  include  decision  and  optimization  ver- 


FRAGILITY  _OPT(k,  G,  S): 

INPUT:  Natural  number  k,  network  G  =  (V,E),  and 
no-strike  set  S 

OUTPUT:  Set  V'  C  V  -  S  s.t.  \V'\  <  k  s.t. 
/TV"  C  V  -  S  s.t.  \V"\  <  k  and  fragileG(V ")  > 
fragileG(V'). 

As  our  problems  seek  to  find  sets  of  nodes,  rather 
than  individual  ones,  it  raises  the  question  of 
“how  difficult  are  these  problems.”  We  prove  that 
FRAGILITY  is  NP-Complete  -  meaning  an  efficient 
algorithm  to  solve  it  optimally  is  currently  unknown. 
Following  directly  from  this  result  is  the  NP-hardness 
of  FRAGILITY  .OPT.  Below  we  state  and  prove 
this  result. 

Theorem  1  (Complexity  of  FRAGILITY). 
FRAGILITY  is  NP-Complete. 

Proof.  Membership  in  NP  is  trivial,  consider  a  set  V' 
of  size  k,  -  clearly  we  can  calculate  fragileG(V')  in 
polynomial  time. 

Next  we  consider  the  vertex-cover  (VC)  problem  and 
show  that  it  can  be  embedded  into  an  instance  of 
FRAGILITY.  In  the  VC  problem,  the  input  con¬ 
sists  of  undirected  graph  G*  =  (V*,E*)  and  natural 
number  k.  The  output  is  “yes”  iff  there  is  a  set 
V**  C  V*  of  size  at  most  k  s.t.  for  all  (i,  j)  G  E* , 
either  i  or  j  (or  both)  are  in  V*.  This  problem  is 
well-known  to  be  NP-hard.  First  we  create  a  new 
network  G  =  (U  E)  which  consists  of  graph  G*  but 
with  NG-  +  2  additional  nodes  which  form  a  star  that 
is  disconnected  from  the  rest  of  the  network.  All  of 
the  new  nodes  are  put  in  the  no-strike  set  S  (part 
of  the  input  of  FRAGILITY).  Clearly,  the  center 
of  this  star  is  always  the  most  central  node  in  the 
graph,  no  matter  what  is  removed  from  set  V  —  S. 
This  allows  us  to  treat  dG  as  a  constant  equal  to 
Ng  +  1.  Also  note  that  with  this  construction,  for 
both  problems,  if  a  solution  exists  of  less  than  size  k, 
there  also  exists  a  solution  of  exactly  size  k.  Further, 
we  note  that  for  any  subset  of  V  whose  removal  does 
not  affect  the  overall  maximal  degree  of  the  network 
(which  is  any  node  outside  the  set  S  -  hence  in  some 
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corresponding  subset  of  V*  in  the  graph  of  the  dom¬ 
inating  set  problem),  when  some  set  V'  (of  size  k)  is 
removed  from  V,  the  network-wide  degree  centrality 
for  the  resulting  graph  can  be  expressed  as  follows: 

frnmlen(V')  -  (^-CWg+D^M^I  U,gv,  ^ 
jragueGyv  )  (jvG-fc-i)(JVG-/c-2) 

The  proof  of  correctness  of  the  embedding  rests  on 

proving  that  a  “yes”  answer  is  returned  for  the  vertex 

cover  problem  iff 

FRAGILITY ( k ,  G,  5)  = 


“yes 

First,  suppose  by  way  of  contradiction  (BWOC)  there 
is  a  “yes”  answer  to  the  VC  problem  and  a  “no”  an¬ 
swer  to  the  corresponding  FRAGILITY  problem. 
Let  V**  be  the  set  of  nodes  that  cause  a  “yes”  an¬ 
swer  to  VC.  If  we  remove  the  corresponding  nodes 
from  G,  there  are  NG*  +  1  edges  left  in  that  net¬ 
work.  Hence,  as  this  is  a  set  of  size  k  (thus,  meeting 
the  cardinality  requirement  of  FRAGILITY  then 
fragileG(V**)  =  which  would 

cause  a  “yes”  answer  for  FRAGILITY  -  hence  a 
contradiction. 

Going  the  other  direction,  suppose  BWOC  there  is 
a  “yes”  answer  to  the  FRAGILITY  problem  and  a 
“no”  answer  to  the  corresponding  VC  problem.  Let 
V'  be  the  nodes  in  the  solution  to  FRAGILITY. 
Clearly,  this  set  is  of  size  k  and  by  how  we  set  up 
the  no-strike  list  (S),  there  are  corresponding  nodes 
in  G**.  As  these  nodes  cause  a  “yes”  answer  to 
FRAGILITY ,  they  result  in  the  removal  of  Mq » 
number  of  edges  in  G.  By  the  construction,  none  of 
these  edges  are  adjacent  to  nodes  in  S.  Hence,  there 
are  corresponding  edges  in  G*.  As  this  is  also  the 
number  of  edges  in  G* ,  then  this  set  is  also  a  vertex 
cover  -  hence  a  contradiction.  Hence,  as  we  have 
shown  membership  in  NP  and  that  this  problem  is  at 
least  as  hard  as  the  dominating  set  problem  (result¬ 
ing  in  NP  hardness),  the  statement  of  the  theorem 
follows.  □ 


Corollary  1  (Hardness  of  FRAGILITY  -OPT). 
FRAGILITY _OPT  is  NP-hard 


Proof.  Follows  directly  from  Theorem  1.  □ 


III  ALGORITHMS 


ponential  time.  However,  good  approximation  tech¬ 
niques  such  as  branch-and-bound  exist  and  mature 
tools  such  as  QSopt  and  CPLEX  can  readily  take  and 
approximate  solutions  to  integer  programs.  We  follow 
our  integer  program  formulation  with  a  greedy  heuris¬ 
tic.  Though  we  cannot  guarantee  that  the  greedy 
heuristic  provides  an  optimal  solution,  it  often  pro¬ 
vides  a  natural  approach  to  approximating  many  NP- 
hard  optimization  problems. 


1  INTEGER  PROGRAM 

Our  first  algorithm  is  presented  in  the  form  of  an 
integer  program.  The  idea  is  that  certain  variables 
in  the  integer  program  correspond  with  the  nodes  in 
the  original  network  that  can  be  set  to  either  0  or 
1.  An  objective  function,  which  mirrors  the  fragile 
function  is  then  maximized.  When  this  function  is 
maximized,  all  nodes  associated  with  a  1  variable  are 
picked  as  the  solution. 

Definition  III.l  {FRAGILITY  JP).  For  each  i  G 
V,  create  variables  Xi,Zi.  For  each  undirected  edge 
ij  G  E,  create  three  variables:  Y ,  Qij ,  Qj j .  Note  that 
the  edge  is  considered  in  only  “one  direction”  for  the 
Y  variables  and  both  directions  for  the  Q  variables. 
We  define  the  FR  AGILITY  NP  integer  program  as 
follows: 


max 


(AG  Yi  Xi)Y,ij  Qij 
(ATc-l-Ei  Xi)(NG- 2-Ei  Xi) 


Subject  to: 


T,ixi<k 

(3) 

£<£<  =  ! 

(4) 

Vij  G  E 

Yij  <  1  -  X, 

(5) 

\/ij  G  E 

Y%j  <1-Xd 

(6) 

\/ij  G  E 

Q  ij  —  Yij 

(7) 

\/ij  G  E 

Qij  —  Yji 

(8) 

\/ij  G  E 

Q  ij  —  Yii 

(9) 

Vi  G  V 

^€{0,1} 

(10) 

VieS 

(11) 

Vi  eV~S 

*<€{0,1} 

(12) 

Now  with  the  problems  and  their  complexity  identi¬ 
fied,  we  proceed  to  develop  algorithms  to  solve  them. 
First,  we  develop  an  integer  program  that,  if  solved 
exactly,  will  produce  an  optimal  solution.  We  note 
that  solving  a  general  integer  program  is  also  NP- 
hard.  Hence,  an  exact  solution  will  likely  take  ex- 


Next  we  prove  how  many  variables  and  constraints 
FRAGILITY  NP  requires  as  well  as  prove  that  it 
provides  a  correct  solution  to  FRAGILITY -OPT. 

Proposition  III.l.  FRAGILITY  NP  has  2  NG  + 
3 Mg  variables  and  2  +  2 NG  +  5 MG  constraints. 
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Proposition  III. 2.  (1.)  Given  the  vector  X  re¬ 
turned  by  FRAGILITY  IP ,  the  set  U  vi=i  *  a  so¬ 
lution  to  FRAGILITY. OPT. 

(2.)Given  a  solution  V'  to  FRAGILITY  .OPT,  Mi  £ 
S,X  =  1  and  Mi  (j  S,X  =  0  will  maximize 
FRAGILITY  JP. 


a  heterogeneous  degree  distribution  where  No  »  k, 
it  is  likely  that  only  the  integer  program  for  the  case 
where  i  =  k  is  needed  as  removing  any  node  with 
edges  that  is  unconnected  to  a  maximal  degree  node 
will  result  in  an  increase  in  network-wide  degree  cen¬ 
trality. 


Proof.  (1.)  Suppose,  BWOC,  Uy=i*  *s  n°t  an  °P~ 
timal  solution  to  FRAGILITY _OPT .  Then  there  is 
some  V'  Uy  =i*  that  is.  Suppose  Vi  £  S,  X  =  1 
and  Mi  ^  S,  X  =  0.  Clearly,  by  the  definition  of  a  so¬ 
lution  to  FRAGILITY. OPT,  constraints  3,11  and 
12  are  all  met.  Constraints  5  and  6  set  variables  as¬ 
sociated  with  edges  adjacent  to  nodes  not  in  V'  to 
1.  Hence,  the  quantity  JA  ■  Yi:j  is  equal  to  the  num¬ 
ber  of  edges  in  the  network.  The  Y  edge  variables 
(both  of  them  for  each  edge)  are  also  set  in  a  simi¬ 
lar  manner.  Constraints  4,10  ensures  that  only  one 
set  of  such  edge  variables  are  set  to  1.  Hence,  the 
quantity  JA  Xi)  ’fZlJ  Qij  is  the  degree  of  one  node  in 
the  network.  As  this  quantity  is  present  in  the  objec¬ 
tive  function  and  non-negative,  it  corresponds  to  the 
d*G.  As  we  note  that  JA  X.t  is  equal  to  the  number 
of  nodes  in  G  when  V'  is  removed,  we  see  that  this 
function  is  fragileG.  As  this  quantity  is  maximized, 
we  have  a  contradiction. 

(2.)  Suppose,  BWOC,  Mi  £  .S',  X  =  1  and 
Mi  S,X  =  0  is  not  an  optimal  solution  to 

FRAGILITY  JP.  Using  the  same  line  of  reason¬ 
ing  as  above,  we  see  that  the  objective  function  of 
FRAGILITY  JP  is  the  same  as  fragilec ,  which 
also  gives  us  a  contradiction.  □ 


Note  that  this  integer  program  does  not  have  a  lin¬ 
ear  objective  function.  However,  this  can  be  ac¬ 
commodated  for  by  instead  solving  k  different  inte¬ 
ger  programs  and  taking  the  solution  from  whichever 
one  returns  the  greatest  value  for  the  objective  func¬ 
tion  (that  is  greater  than  the  initial  network-wide 
degree  centrality,  of  course).  In  this  case,  each  in¬ 
teger  program  is  identified  with  a  natural  number 
i  £  { 1, . . . ,  k}  and  the  ith  integer  program  has  the 
following  objective  function: 


max 


(Nq 

(Na-l-i){Na-2-i) 


(13) 


As  well  as  constraint  3  as  follows: 


E  i*i<i  (14) 


Notice  that  now  the  quantities  (Nc  —  i)  and  (NG  —  1  — 
*)  (Nq  —  2  —  *)  can  be  treated  as  constants,  making  the 
objective  function  linear.  However,  for  networks  with 


Again,  we  stress  that  FRAGILITY _IP  provides  an 
exact  solution.  As  integer-programming  is  also  NP- 
hard,  solving  these  constraints  is  likely  intractable 
unless  P  =  NP.  However,  techniques  such  as  branch- 
and-bound  and  mature  solvers  such  as  QSopt  and 
CPLEX  can  provide  good  approximate  solutions  to 
such  constraints.  Even  if  the  integer  program  must 
be  linear,  we  can  use  the  techniques  described  above 
to  solve  k  smaller  integer  programs  or  obtaining  an 
approximation  by  treating  the  terms  involving  the 
total  number  of  nodes  in  the  resulting  graph  (in  the 
objective  function)  as  constants.  Additionally,  a  re¬ 
laxation  of  the  above  constraints  where  Zt  and  Xt 
variables  lie  in  the  interval  [0, 1]  is  solvable  in  poly¬ 
nomial  time  and  would  provide  a  lower-bound  on  the 
solution  to  the  problem  (although  this  would  likely 
be  a  loose  bound  in  many  cases). 

2  A  GREEDY  HEURISTIC 

The  integer  program  introduced  in  the  last  section 
can  be  leveraged  by  an  integer-program  solver  for  an 
approximate  solution  to  FRAGILITY  .OPT.  How¬ 
ever,  it  likely  will  not  scale  well  to  extremely  large 
networks.  Therefore,  we  introduce  a  greedy  heuristic 
to  find  an  approximate  solution.  The  ideas  is  to  it¬ 
eratively  pick  the  node  in  the  network  that  provides 
the  greatest  increase  in  fragile  -  and  does  not  cause 
a  decrease.  The  following  proposition  characterizes 
the  algorithm’s  output.  Though  our  guarantees  on 
GREEDY. FRAGILE  are  limited,  we  show  that  it 
performs  well  experimentally  in  the  next  section. 

Proposition  III.3.  If  GREEDY  .FRAGILE  re¬ 
turns  a  non-empty  solution  (V' ),  then  \V'\  <  k  and 
fragileG(V')  >  fragileG(%). 


Proof.  As  the  algorithm  terminates  its  main  loop 
once  the  cardinality  of  the  solution  reaches  k  and  as 
in  each  iteration,  the  variable  curBestScore  is  ini¬ 
tialized  as  zero,  the  statement  follows.  □ 
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Algorithm:  GREEDY  .FRAGILE 
Require:  Network  G  =  (V,E),  no-strike  set  S  C  V, 
cardinality  constraint  k 
Ensure:  Subset  V' 

1:  V'  =  0 
2:  flag  =  TRUE 
3:  while  \V'\  <  k  and  flag  do 
4:  curBest  =  null,  curBestScore  =  0, 

haveValidScore  =  FALSE 
5:  for  i  G  V  —  (V'  U  S)  do 

6:  curScore  =  fragileciV'  U  {*})  — 

fragileG(V') 

7:  if  curScore  >  curBestScore  then 

8:  curBest  =  i 

9:  curBestScore  =  curScore 

10:  haveValidScore  =  TRUE 

11:  end  if 

12:  end  for 

13:  if  haveValidScore  =  F ALSE  then 

14:  flag  =  FALSE 

15:  else 

16:  V'  =  V'  U  {curBest} 

17:  end  if 

18:  end  while 
19:  return  V' . 

We  also  note  that  the  algorithm  runs  in  polynomial 
time  with  the  following  proposition. 

Proposition  III. 4.  GREEDY. FRAGILE  runs  in 
0{kNo)  time. 


Proof.  We  note  that  fragile  is  computed  in  0(Nq ) 
time  as  it  must  update  the  node  with  the  maximum 
degree.  As  the  outer  loop  of  the  algorithm  iterates  at 
most  k  times  and  the  inner  loop  iterates  Nq  times, 
the  statement  follows.  □ 

Example  III.l.  Following  from  Examples  II.1-II.2 
using  the  terrorist/insurgent  network  Gsam  from 
[Figure  1],  suppose  a  user  wants  to  identify  3  nodes 
that  will  cause  the  network  to  become  “as  fragile  as 
possible”  and  is  able  to  target  any  node.  Hence,  he 
would  like  to  solve  FRAGILE _OPT(3,Gsarn,$)  and 
decides  to  do  so  using  GREEDY. FRAGILE.  Ini¬ 
tially,  fragileGsam(h )  =  0.33.  In  the  first  iteration, 
it  selects  and  removes  node  a,  increasing  the  fragility 
(fragilecsam  ({a})  =  0.57,1.  In  the  next  iteration,  it 
selects  node  j,  giving  us  fragileGsam({a,  j})  =  0.57. 
Finally,  in  the  third  iteration,  it  picks  node  c.  This 
results  in  fragileGBam{{a,  j,  c})  =  0.6.  The  algorithm 
then  terminates. 


IV  IMPLEMENTATION  AND  EXPERI¬ 
MENTS 

All  experiments  were  run  on  a  computer  equipped 
with  an  Intel  Core  2  Duo  CPU  T9550  processor 
operating  at  2.66  GHz  (only  one  core  was  used). 
The  machine  was  running  Microsoft  Windows  7  (32 
bit)  and  equipped  with  4.0  GB  of  physical  mem¬ 
ory.  We  implemented  the  GREEDY  .FRAGILE  al¬ 
gorithm  using  Python  2.6  in  under  30  lines  of  code 
that  leveraged  the  NetworkX  library  available  from 
http:/ /networkx. lanl.gov/. 

We  compared  the  results  of  the  GREEDY. FRAGILE 
to  three  other  more  traditional  approaches  to  target¬ 
ing  that  rely  on  centrality  measures  from  the  litera¬ 
ture.  Specifically,  we  look  at  the  top  closeness  and 
betweenness  nodes  in  the  network.  Given  node  i,  its 
closeness  is  the  inverse  of  the  average  shortest  path 
length  from  node  i  to  all  other  nodes  in  the  graph. 
Betweenness,  on  the  other  hand,  is  defined  as  the 
number  of  shortest  paths  between  node  pairs  that 
pass  through  i.  Formal  definitions  of  both  of  these 
measures  can  be  found  in  [4]. 

1  DATASETS 

We  studied  the  effects  of  our  algorithm  on  five  dif¬ 
ferent  datasets.  The  network  Tanzania  [5]  is  a 
social  network  of  the  individuals  involved  with  the 
A1  Qaeda  bombing  of  the  U.S.  embassy  in  Dar 
es  Salaam  in  1998.  It  was  collected  from  news¬ 
paper  accounts  by  subject  matter  experts  in  the 
field.  The  remainder  networks,  GenTerrorNwl- 
GenTerrorNw4  are  terrorist  networks  generated 
from  real-world  classified  datasets  [6,7].  The  Tan¬ 
zania  and  the  GenTerrorNwl-GenTerrorNw4 
datasets  used  in  our  analysis  were  multi-modal  net¬ 
works,  meaning  they  contain  multiple  node  classes 
such  as  Agents,  Resources,  Locations,  etc.  The  pres¬ 
ence  of  the  different  node  classes  generate  multiple 
or  meta  networks,  which,  in  their  original  state,  do 
not  provide  the  single-mode  Agent  by  Agent  net¬ 
work  needed  to  test  our  algorithms.  Johnson  and 
McCulloh  [8]  demonstrated  a  mathematical  tech¬ 
nique  to  convert  meta  networks  into  single-mode  net¬ 
works  without  losing  critical  information.  Using  this 
methodology,  we  were  able  to  derive  distant  relation¬ 
ships  between  nodes  as  a  series  of  basic  matrix  al¬ 
gebra  operations  on  all  five  networks.  The  result  is 
an  agent  based  social  network  of  potential  terrorist. 
Characteristics  of  the  transformed  networks  of  agent 
node  class  only  can  be  found  in  [Table  1]. 
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Name 

Nodes 

Edges 

Density 

Avg.  Deg. 

Tanzania 

17 

29 

0.213 

3.412 

GenTerrorNwl 

57 

162 

0.102 

5.684 

GenTerrorNw2 

102 

388 

0.0753 

7.608 

GenTerrorNw3 

105 

590 

0.108 

11.238 

GenTerrorNw4 

135 

556 

0.0615 

8.237 

URV  E-Mail 

1, 133 

5,541 

0.00864 

9.781 

CA-NetSci 

1,463 

2,743 

0.00256 

3.750 

Table  1:  Network  Datasets 


2  INCREASING  THE  FRAGILITY  OF 
NETWORKS 

In  our  experiments,  we  showed  that  our  algorithm 
was  able  to  significantly  increase  the  network-wide 
degree  centrality  by  removing  nodes  -  hence  increas¬ 
ing  the  fragile  function  with  respect  to  a  given  net¬ 
work.  In  each  of  the  five  real-world  terrorist  networks 
that  we  examined,  removal  of  only  12%  of  nodes 
can  increase  the  network-wide  centrality  between  17% 
and  45%  (see  [Figure  3]-[Figure  7]).  In  [Figure  2]  we 
show  a  visualization  of  how  the  Tanzania  network 
becomes  more  “star-like”  with  subsequent  removal  of 
nodes  by  the  greedy  algorithm. 

For  comparison,  we  also  looked  at  the  removal  of  high 
degree,  closeness,  and  betweenness  nodes.  Removal  of 
high-degree,  closeness,  or  betweenness  nodes  tended 
to  increase  the  network-wide  centrality.  In  other 
words,  traditional  efforts  of  targeting  leadership  with¬ 
out  first  conducting  shaping  operations  may  actually 
increase  the  organization’s  ability  to  regenerate  lead¬ 
ership  -  as  such  targeting  operations  effectively  cause 
an  organization  to  de-centralize.  We  display  these 
results  graphically  in  [Figure  3]- [Figure  7].  Notice 
that  GREEDY  .FRAGILE  consistently  causes  an 
increase  in  the  network-wide  degree  centrality.  An 
analysis  of  variance  (ANOVA)  reveals  that  there  is  a 
significant  difference  in  the  performance  among  our 
algorithm  and  the  centrality  measures  with  respect  to 
increase  or  decrease  in  network-wide  degree  centrality 
(p-value  less  than  2.2  •  10-16,  calculated  with  R  ver¬ 
sion  2.13).  Additionally,  pairwise  analysis  conducted 
using  Tukey’s  Honest  Significant  Difference  (HSD) 
test  indicates  that  the  results  of  our  algorithm  differ 
significantly  from  any  of  the  three  centrality  measures 
with  a  probability  approaching  1.0  (95%  confidence, 
calculated  with  R  version  2.13).  Typically,  the  ra¬ 
tio  of  percent  increase  in  fragility  to  the  percent  of 
removed  nodes  is  typically  2  :  1  or  greater. 


Visualization  of  the  Tanzania  network  after  nodes  removed  by 
GREEDY  .FRAGILE.  Panel  A  shows  the  original  network.  Panel  B 
shows  it  after  3  nodes  are  removed,  panel  C  shows  the  result  of  5 
nodes  removed,  and  panel  D  shows  the  network  after  9  nodes  are 
removed.  Notice  that  the  network  becomes  more  “star-like.” 


Percentage  of  Nodes  Removed 


fig.  3 


Percent  of  nodes  removed  vs.  percent  increase  in  fragility  for  the 
Tanzania  network  using  GREEDY -FRAGILE,  top  degree,  top 
closeness,  and  top  betweenness.  The  scale  of  the  x-axis  is  positioned  at 

0%. 


VGreedyFragile 
■  Top  Degree 
▲  Top  Closeness 
Top  Betweenness 


Percentage  of  Nodes  Removed 


fig.  4 


Percent  of  nodes  removed  vs.  percent  increase  in  fragility  for  the 
GenTerrorNetl  network  using  GREEDY -FRAGILE,  top  degree, 
top  closeness,  and  top  betweenness.  The  scale  of  the  x-axis  is 
positioned  at  0%. 
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3  RUNTIME 


♦  Greedy_Fragile 
25  ■Top  Degree 
A  Top  Closeness 
X'Top  Betweenness 


-60 


-80 


■■■ 


Percentage  of  Nodes  Removed  g 

Percent  of  nodes  removed  vs.  percent  increase  in  fragility  for  the 
GenTerrorNw2  network  using  GREEDY_FRAGILE,  top  degree,  top 
closeness,  and  top  betweenness.  The  scale  of  the  x-axis  is  positioned  at 

0%. 


We  also  evaluated  the  run-time  of  the 
GREEDY  .FRAGILE  algorithm.  With  the  largest 
terror  network  considered  (GenTerrorNw4),  we 
achieved  short  runtime  (under  7  seconds)  on  stan¬ 
dard  commodity  hardware  (see  [Figure  8]).  Hence, 
in  terms  of  runtime,  our  algorithm  is  practical  for 
use  by  a  real-world  analyst.  As  predicted  in  our 
time  complexity  result,  we  found  that  the  runtime  of 
GREEDY  .FRAGILE  increases  with  the  number  of 
nodes  removed.  We  note  that  the  implementations 
of  top  degree,  closeness,  and  betweenness  calculate 
those  measures  for  the  entire  network  at  once  -  hence 
increasing  the  number  of  nodes  to  remove  does  not 
affect  their  runtime. 


v  Greedy_Fragile 
HTop  Degree 
A  Top  Closeness 
Top  Betweeness 


fig.  6 

Percent  of  nodes  removed  vs.  percent  increase  in  fragility  for  the 
GenTerrorNw3  network  using  GREEDY-FRAGILE,  top  degree, 
top  closeness,  and  top  betweenness.  The  scale  of  the  x-axis  is 
positioned  at  0%. 


❖  Greedy_Fragile 
■  Top  Degree 
A  High  Closeness 
High  Betweenness 


Number  of  Nodes  Removed 


fig.  8 


Number  of  nodes  removed  vs.  runtime  for  the  GenTerrorNw4 


network  using  GREEDY -F  RAGI LE ,  top  degree,  top  closeness,  and 
top  betweenness. 


4  EXPERIMENTS  ON  LARGE  DATA¬ 
SETS 
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v-  GreedyFragile 
■  Top  Degree 
A  Top  Closness 
-  Top  Betweenness 


Percentage  of  Nodes  Removed 


fig.  7 


Percent  of  nodes  removed  vs.  percent  increase  in  fragility  for  the 
GenTerrorNw4  network  using  GREEDY-FRAGILE,  top  degree, 
top  closeness,  and  top  betweenness.  The  scale  of  the  x-axis  is 
positioned  at  0%. 


To  study  the  scalability  of  GREEDY  .FRAGILE, 
we  also  employed  it  on  two  large  social  networks. 
Note  that  these  datasets  are  not  terrorist  or  insurgent 
networks.  However,  the  larger  size  of  these  datasets 
is  meant  to  illustrate  how  well  our  approach  scales. 
For  these  experiments,  we  used  an  e-mail  network 
from  University  Rovira  i  Virgili  (URV  E-Mail)  [9] 
and  a  Network  Science  collaboration  network  (CA- 
NetSci)  from  [10]  (see  [Table  1]).  In  [Figure  9]  we 
show  the  percentage  of  nodes  removed  vs.  the  per¬ 
cent  increase  in  fragility.  We  note  that  2  :  1  ratio 
of  percent  increase  in  fragility  to  the  percent  of  re¬ 
moved  nodes  appears  to  be  maintained  even  in  these 
large  datasets.  In  [Figure  10]  we  show  the  runtime  for 
GREEDY. FRAGILE  on  the  two  large  networks. 
We  note  that  the  behavior  of  runtime  vs.  number  of 
nodes  removed  resembles  that  of  the  GenTerrorNw4 
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network  from  the  previous  section.  Also  of  interest 
is  that  the  algorithm  was  able  to  handle  networks  of 
over  a  thousand  nodes  in  about  20  minutes  on  com¬ 
modity  hardware. 

V  RELATED  WORK 

Various  aspects  of  the  resiliency  of  terrorist  networks 
have  been  previously  explored  in  the  literature.  For 
instance,  [11]  studies  the  ability  such  network  to  facil¬ 
itate  communication  while  maintaining  secrecy  while 
[12]  studies  how  such  networks  are  resilient  to  cas¬ 
cades.  However,  to  our  knowledge,  the  network-wide 
degree  centrality  in  such  networks  -  and  how  to  in¬ 
crease  this  property  -  has  not  been  previously  studied. 

There  has  been  much  work  dealing  with  the  removal 
of  nodes  from  a  network  to  maximize  fragmenta¬ 
tion  [13-15]  where  the  nodes  removed  are  mean  to  ei¬ 
ther  increase  fragmentation  of  the  network  or  reduce 
the  size  of  the  largest  connected  component.  While 
this  work  has  many  applications,  it  is  important  to 
note  that  there  are  special  considerations  of  terror¬ 
ist  and  insurgent  networks  that  we  must  account  for 
in  a  targeting  strategy.  For  instance,  if  conducting 
a  counter-intelligence  operation  while  targeting,  as 
in  the  case  of  [3],  it  may  be  desirable  to  preserve 
some  amount  of  connectivity  in  the  network.  Ad¬ 
ditionally,  fragmentation  of  a  network  may  result  in 
the  splintering  of  an  organization  into  smaller,  but 
more  radical  and  deadly  organizations.  This  hap¬ 
pens  because  in  some  cases,  it  may  be  desirable  to 
keep  certain  terrorist  or  insurgent  leaders  in  place  to 
restrain  certain,  more  radical  elements  of  their  orga¬ 
nization.  Such  splinter  was  observed  for  the  insurgent 
organization  Jaysh  al-Malidi  in  Iraq  [16].  Further, 
these  techniques  do  not  specifically  address  the  issue 
of  emerging  leaders.  Hence,  if  they  were  to  be  used  for 
counter-terrorism  or  counter-insurgency,  they  would 
likely  still  benefit  from  a  shaping  operation  to  reduce 
organization’s  ability  to  regenerate  leadership. 

There  has  been  some  previous  work  on  identifying 
emerging  leaders  in  terrorist  networks.  Although 
such  an  approach  could  be  useful  in  identifying  cer¬ 
tain  leaders,  it  does  not  account  the  organizations 
ability  as  a  whole  to  regenerate  leadership.  In  [2], 
the  topic  of  cognitive  demand  is  studied.  The  cog¬ 
nitive  load  of  an  individual  deals  with  their  ability 
to  handle  multiple  demands  on  their  time  and  work 
on  complex  tasks.  Typically,  this  can  be  obtained 
by  studying  networks  where  the  nodes  may  repre¬ 
sent  more  than  individual  people  -  but  tasks,  events, 


and  responsibilities.  However,  it  may  often  be  the 
case  that  this  type  of  information  is  often  limited  or 
non-existent  in  many  situations.  Additionally,  as  dis¬ 
cussed  throughout  this  paper,  the  targeting  of  indi¬ 
vidual  nodes  may  often  not  be  possible  for  various 
reasons.  Hence,  our  framework,  that  focuses  on  the 
network’s  ability  to  regenerate  leadership  as  opposed 
to  finding  individual  emerging  leaders  may  be  more 
useful  as  we  can  restrict  the  available  nodes  in  our 
search  using  the  “no  strike  list.”  By  removing  these 
nodes  from  targeting  consideration  -  but  by  still  con¬ 
sidering  their  structural  role  -  our  framework  allows 
a  security  force  to  reduce  the  regenerative  ability  of  a 
terror  network  by  “working  around”  individuals  that 
may  not  be  targeted. 

In  more  recent  work  [17]  looks  at  the  problem  of  re¬ 
moving  leadership  nodes  from  a  terrorist  or  crimi¬ 
nal  network  in  a  manner  that  accounts  for  new  links 
created  in  the  aftermath  of  an  operation.  Addition¬ 
ally,  [18]  look  at  identifying  leaders  in  covert  terrorist 
network  who  attempt  to  minimize  their  communica¬ 
tion  due  to  the  clandestine  nature  of  their  operations. 
They  do  this  by  introducing  a  new  centrality  mea¬ 
sure  called  “covertness  centrality.”  Both  of  these  ap¬ 
proaches  are  complementary  to  ours  as  they  focus  on 
the  leadership  of  the  terrorist  or  insurgent  group  - 
as  this  approach  focuses  on  the  networks  ability  to 
re-generate  leadership.  A  more  complete  integration 
of  this  approach  leadership  targeting  method  such  as 
these  (i.e.  using  a  network-wide  version  of  covertness 
centrality)  is  an  obvious  direction  for  future  work. 
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Percent  of  nodes  removed  vs.  percent  increase  in  fragility  for  the  URV 
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Number  of  nodes  removed  vs.  runtime  for  the  XJR.V  E-Mail  and 
CA-NetSci  networks  using  GREEDY  _F  RAGILE . 

VI  CONCLUSIONS 

In  this  paper  we  described  how  to  target  nodes  in  a 
terrorist  or  insurgent  network  as  part  of  a  shaping 
operation  designed  to  reduce  the  organization’s  abil¬ 
ity  to  regenerate  leadership.  Our  key  intuition  was 
to  increase  the  network-wide  degree  centrality  which 
would  likely  have  the  effect  of  eliminating  emerging 
leaders  as  maximizing  this  quantity  would  intuitively 
increase  the  organization’s  reliance  on  a  single  leader. 


In  this  paper,  we  found  that  though  identifying  a  set 
of  nodes  to  maximize  this  network-wide  degree  cen¬ 
trality  is  NP-hard,  our  greedy  approach  proved  to 
be  a  viable  heuristic  for  this  problem,  increasing  this 
quantity  between  17%  — 45%  in  our  experiments.  Fu¬ 
ture  work  could  include  an  examination  of  other  types 
of  network-wide  centrality  -  for  instance  network¬ 
wide  closeness  centrality  -  instead  of  network-wide 
degree  centrality.  Another  aspect  that  we  are  consid¬ 
ering  in  ongoing  research  is  determining  the  effective¬ 
ness  of  the  shaping  strategy  when  we  have  observed 
only  part  of  the  terrorist  or  insurgent  organization  - 
as  is  often  the  case  as  such  networks  are  created  from 
intelligence  data. 
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